This function is used to create a legal SQL string that you can use in an
SQL statement. The given string is encoded to an escaped SQL string,
taking into account the current character set of the connection.

Caution

Security: the default character set

The character set must be set either at the server level, or with
the API function mysqli_set_charset() for it to affect
mysqli_real_escape_string(). See the concepts section
on character sets for
more information.

To escape for the purposes of having your queries made successfully, and to prevent SQLi (SQL injection)/stored and/or reflected XSS, it's a good idea to go with the basics first, then make sure nothing gets in that can be used for SQLi or stored/reflected XSS, or even worse, loading remote images and scripts.

// ... then your entities will reflect back as the characters, so // input such as this: "><img src=x onerror=alert('xss')> // will display the 'xss' in an alert box in the browser.}

mysqli_free_result($res);mysqli_close($conn);?>

In most cases, you wouldn't want to go way overboard sanitizing untrusted user input, for instance:

<?php $my_input = htmlspecialchars( strip_tags($_POST['foo']) );?>

This will junk a lot of input you might actually want, if you're rolling your own forum or comments section and it's for web developers, for example. On the other hand, if legitimate users are never going to enter anything other than text, never HTML tags or anything else, it's not a bad idea.

The take-away is that mysqli_real_escape_string() is not good enough, and being overly-aggressive in sanitizing input may not be what you want.

Be aware that in the above example, it will protect you from sqli (run sqlmap on all your input fields and forms to check) but it won't protect your database from being filled with junk, effectively DoS'ing your Web app in the process.

So after protecting against SQLi, even if you're behind CloudFlare and take other measures to protect your databases, there's still effectively a DoS attack that could slow down your Web App for legitimate users and make it a nightmare filled with rubbish that some poor maintainer has to clean out, if you don't take other measures.

So aside from escaping your stings, and protecting against SQLi and stored/reflected XSS, and maliciously loaded images or JS, there's also checking your input to see if it makes sense, so you don't get a database full of rubbish!

You can avoid all character escaping issues (on the PHP side) if you use prepare() and bind_param(), as an alternative to placing arbitrary string values in SQL statements. This works because bound parameter values are NOT passed via the SQL statement syntax.

These functions represent alternatives to mysqli::real_escape_string, as long as your DB connection and Multibyte extension are using the same character set (UTF-8), they will produce the same results by escaping the same characters as mysqli::real_escape_string.

When escaping strings for `LIKE` syntax, remember that you also need to escape the special characters _ and %

So this is a more fail-safe version (even when compared to mysqli::real_escape_string, because % characters in user input can cause unexpected results and even security violations via SQL injection in LIKE statements):

The original MySQL `utf8` character-set (for tables and fields) only supports 3-byte sequences.4-byte characters are not common, but I've had queries fail to execute on 4-byte UTF-8 characters, so you should be using `utf8mb4` wherever possible.

However, if you still want to use `utf8`, you can use the following function to replace all 4-byte sequences.

A PHP application I'm working on has many pages which (long story) need to share a PHP API that looks after a MySQL database. Easiest way was to have the app pages AJAX to the API .PHPs.

That means having the JavaScript of the AJAX encodeURIComponent(...) relevant bits of any data to be sent via HTTP POST and GET requests - space as %20 and so on.

But the SQL also needed real_escape_string(...) of the same data.

So I had the issue of whether to do the real_escape_string *before* or *after* encodeURIComponent? in other words in the application PHP or API PHP? Do either of the encodings mangle the other?

The real_escape_string would be "cleaner" in the API, both in principle, and because it needs an instance of mysqli class and there are are unlikely to be instances in the app.

(real_escape_string needs an instance because it's not a *static* function - I don't know why).

But I suspect that "in the API" is the mangle-avoiding place: the JavaScript encode gets undone by the HTTP call to whichever API element, then the element can safely real_escape_string what is to be put into the database.